Verify /boot/grub2/user.cfg Group Ownership

Classification:

compliance

Framework:

Control:

Description

The file /boot/grub2/user.cfg should be group-owned by the root group to prevent reading or modification of the file.

To properly set the group owner of /boot/grub2/user.cfg, run the command:

$ sudo chgrp root /boot/grub2/user.cfg

Rationale

The root group is a highly-privileged group. Furthermore, the group-owner of this file should not have any access privileges anyway. Non-root users who read the boot parameters may be able to identify weaknesses in security upon boot and be able to exploit them.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

# Remediation is applicable only in certain platforms
if [ ! -d /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then

chgrp 0 /boot/grub2/user.cfg

else
 >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Gather the package facts
 package\_facts:
 manager: auto
 tags:
 - CCE-86008-0
 - CJIS-5.5.2.2
 - NIST-800-171-3.4.5
 - NIST-800-53-AC-6(1)
 - NIST-800-53-CM-6(a)
 - PCI-DSS-Req-7.1
 - configure\_strategy
 - file\_groupowner\_user\_cfg
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed

- name: Test for existence /boot/grub2/user.cfg
 stat:
 path: /boot/grub2/user.cfg
 register: file\_exists
 when:
 - '"/boot/efi" not in ansible\_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible\_facts.packages'
 - ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-86008-0
 - CJIS-5.5.2.2
 - NIST-800-171-3.4.5
 - NIST-800-53-AC-6(1)
 - NIST-800-53-CM-6(a)
 - PCI-DSS-Req-7.1
 - configure\_strategy
 - file\_groupowner\_user\_cfg
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed

- name: Ensure group owner 0 on /boot/grub2/user.cfg
 file:
 path: /boot/grub2/user.cfg
 group: '0'
 when:
 - '"/boot/efi" not in ansible\_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible\_facts.packages'
 - ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file\_exists.stat is defined and file\_exists.stat.exists
 tags:
 - CCE-86008-0
 - CJIS-5.5.2.2
 - NIST-800-171-3.4.5
 - NIST-800-53-AC-6(1)
 - NIST-800-53-CM-6(a)
 - PCI-DSS-Req-7.1
 - configure\_strategy
 - file\_groupowner\_user\_cfg
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed